These slides discuss the WHEN and HOW of various common and special purpose extensions in Burp Suite for application security testing. It was presented in Null Bangalore as a Puliya session by Neelu Tripathy.

1. L E S S E R K N O W N
BURP EXTENSIONS
N E E L U T R I PAT H Y

2. MARKET
• Replicator
• SAML Raider
• Logger ++
• Active Scan++
• WSDLER
• Software Vulnerability
Scanner
• Backslash

3. REPLICATOR
• Pentesting Focused
• Replicate PoC for Developers
• Used Twice > Before and After FIX Applied
• One Vector Per Instance
• Specially where encoding/fuzzing is involved
• Developer: Should Understand it is just a PoC & can have variations
• Finding Wise: User wise session macro

4. MODES
TESTER MODE
• Immediate PoC from Burp Suite
• Input from Other Tabs > Replicator
• Regex: Specify Expressions Manually
• Create Session Macro
• Scrub cookies
• Test All
• Save to replicator.json
DEVELOPER MODE
• Load replicator.json
• Use inbuilt session macros
• Works across Environments(dev, pre-
prod, etc)
• Clearing Cookies > Test All
• Apply Fix
• Test All

5. WHEN TO USE
PROOF OF CONCEPT
Team awareness:
Developers, Test Teams,
Security Testing
As a substitute for
documentation:
Incremental testing
LIMITATIONS
Not Exhaustive: Cross Site
Scripting, SQl Injections,
Permutational Issues
WAF in Place

6. DEMO

7. SAML RAIDER
• Roland Bischofberger and Emanuel Duss
• Security Assertion MarkUp Language
• SSO and FEDERATED Logins
• Assertions from IDP
• XML Attacks(XXE, etc)
• Signature Manipulation( Tampering Attributes, Replay, Re-signing, etc)
• Certificate Striping
• Issues:
– Authentication,
– Authorization Bypass
– Privilege Escalation

8. S A M L S T R U C T U R E

9. ATTACK SURFACE
Sign the
Message
Sign the
Assertion
Sign the
Assertion
and later
sign the
Message
Tampering
Public
Keys and
Certificat
es
Service
Provide
and
Identity
Provider

10. E X A M P L E S
TA M P E R I N G
S I G N AT U R E
WRAPPING

11. LOGGER++
• Soroush Dalili & Corey Arthur
• Log All You Want
• Free
• Also logs Sequencer, Spider, Intruder and so on..
• Save and Export as CSV
• Grepping
• Versatile Filters(Method, Query, Request, Response,…)

12. DEMO

13. ACTIVE SCAN ++
• James Kettle
• Pro Burp Suite
• Advanced Testing On Top Of Existing
Active Scan
• Esoteric Issues
Deployment Pre-Requisites
• Jython 2.5 or later
• jython-standalone-2.5.jar
• activeScan++.py

14. WHAT DO WE
GET
Struts2 RCE - CVE-2017-5638 / S2-045
Host Header Injection (password reset poisoning, cache
poisoning, DNS rebinding)
CVE-2014-6271/CVE-2014-6278 'shellshock' and CVE-2015-
2080, CVE-2017-5638, CVE-2017-12629
Edge Side Includes
XML Input Handling
Blind code injection via expression language, Ruby's open()
and Perl's open()

15. DEMO

16. WSDLER
• Eric Gruber
• Parse WSDL
• Operations, Bindings and EndPoints
• Data Types Defined
• Run Through Other Functions
• Soap 1.1 Support Only

17. DEM
O

18. SOFTWARE
VULNERABILITY
SCANNER
[VULNERS]
• Vulners Scanner
• Software Detection + Vulnerability
• Methodology: HTTP Response Header Based
Fingerprinting
• vulners.com search API
• CVEs, Advisories , Exploits!
• Caution: False Positives

19. O V E R V I E W

20. R E S U L T S

21. BACKSLASH
POWERED
SCANNER
Research Grade Vulnerabilities
High-Hanging Fruits
Injection Vulnerabilities
Input Filtering
Red Teaming
Avoiding WAF
JSON injection to RCE
Server-Side HTTP Parameter Pollution
Eescape sequence injection

22. OTHER EX’S
Heartbleed
PHP Object
Injection Check
J2EEScan
AWS Security
Checks
Java
Deserialization
Scanner
RandomIP
Address Header
Decoder
improved
CMS Scanner Blazer

23. REFERENCES
• https://portswigger.net/bappstore
• https://github.com/nccgroup/BurpSuiteLoggerPlu
sPlus
• https://github.com/portswigger/active-scan-plus-
plus
• https://www.youtube.com/watch?v=dxo6-niEtyE
• https://github.com/vulnersCom/burp-vulners-
scanner
• https://github.com/portswigger/logger-plus-plus
• https://github.com/portswigger/saml-raider
• https://portswigger.net/bappstore/9cff8c55432a4
5808432e26dbb2b41d8
• https://www.youtube.com/watch?v=EPmjl7q1-
n4&list=PLuUtcRxSUZUpv2An-
RNhjuZSJ5fjY7ghe&index=3